---
id: CVE-2026-101074
title: A weakness has been identified in Netcore NR289-GE 1.4.5102
summary: >-
  A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected
  element is the function password-check of the file /bin/boa of the component
  Authentication. Executing a manipulation of the argument Username can lead to
  stack-ba…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-119
  - CWE-121
vendor: Netcore
product: NR289-GE
affected:
  - NR289-GE 1.4.5102
published: '2026-09-28'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T15:17:12.830'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101074'
references:
  - url: >-
      https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_boa_stack_overflow.md
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-101074'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/929202'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/410945'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/410945/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-28T15:20:40.208425Z'
ingestedAt: '2026-09-28T15:13:31.603Z'
---

## Overview

A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Executing a manipulation of the argument Username can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.